Security policy: how to report a vulnerability

Found a security problem in FosterStack Cache or on this website? Tell us privately. Here is how, what happens next, and what we sign and publish so you can check our work.

Report a vulnerability

• For the cache server and its releases: private vulnerability report on GitHub.
• For this website: private vulnerability report on GitHub.
• If GitHub's form is not available to you, open an issue that asks for a private channel, with no details in it. We will follow up.

Send the report, not a patch. Please do not post details publicly before a fix ships.

What we aim for

Vulnerable dependencies fixed fast — our target is 48 hours from disclosure. Security patches are never withheld from the free tier: the same fix ships to everyone on the same day.

The supported version is the latest minor release.

What we sign and publish

Releases are built only in CI. Each one comes with files you can check without an account:

• Container images, signed without a stored key (Sigstore), with build provenance.
• checksums.txt with its own signature file.
• A software bill of materials (SBOM) for each binary archive.
• A VEX file saying which known vulnerabilities do and do not affect the release.
• A release-manifest.json listing every file and its digest.

The commands are under "Verifying a release" in RELEASING.md. See also how we build.

Every published image is scanned again every day, so a vulnerability disclosed against something we already shipped raises an issue.

What the server does with your data

The server sends no telemetry and needs no connection to FosterStack: no usage reporting, no licence check, no update ping. It stores what your build tool sends it, which is cache keys and the files they point to. You can check that it makes no outbound connections, and the command is in the security policy on GitHub.

This website has no forms, no cookies, no analytics and no third-party requests.

What we do not claim

• The server has a read-write login and an optional read-only login. There is no per-person identity yet.
• The paid tiers are not built.

Machine-readable contact: security.txt.